Numerous control methods and their corresponding devices provide for regularly recording signals from sensors, for analyzing the recorded signals, and for generating appropriate control signals in response to the analysis. An example is a control system for triggering airbags which regularly executes a process that includes the following incremental steps: recording the signals from sensors, processing the signals, and generating a control signal for the airbag.
A malfunction of the real-time system or of the executed processes can lead to a triggering of the airbag. This is prevented in that the real-time system monitors the execution of the processes and, in response to detection of a malfunction, an outputting of a control signal to the airbag is blocked.
A method for clarifying a problem definition of the exemplary embodiment and/or exemplary method of the present invention is shown in FIG. 8. Processes P60, P61, P62 are started by a real-time system S′ in accordance with the time-slot pattern at points in time t61, t62 at time interval dT. Two processes P60, P61 are combined into pairs, respectively, and, in response to the starting of first process P60 of the two processes, a counter Z′ is started, and, in response to the ending of second process P61, counter Z′ is stopped. Thus, counter count C60 is a measure of the entire execution duration of the two processes P60, P61. If counter count C62 exceeds a value predefined by a maximum period of time TMax, an overflow error message F1 is output. If a malfunction occurs during a first process P62 of a pair, then, starting with the starting point in time t62 of this process P62, the maximum period of time T′Max lapses until error signal F′1 is output. This is undesirably long, in particular since the maximum period of time T′Max must be longer than two time intervals dT of the execution grid. In addition, process execution times that are too short, likewise pointing to a malfunction of the real-time system or of the processes, are not always able to be detected. In FIG. 9, both process P66, as well as process P69 are atypically short. If the too short process is the second process of a pair P68, P69, the counter Z′ records a count C68, which is shorter than predefined by the minimum period of time T′min, and, as a consequence thereof, an underflow error signal F′2 is output. However, if the too short process P66 is the first of a pair P66, P67, then, due to the start of the second process in accordance with the time-slot pattern at point in time t67, no count C66 is recorded that is shorter than the corresponding minimal period of time T′min.